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Updox Certified Health IT 
2024 Real World Testing Plan 


Updox, the leading healthcare communication platform for in-person and virtual care, is elated 
to provide software that is certified under the Office of the National Coordinator (ONC) for 
Health Information Technology to the public. You will find in Updox’s 2023 Real World Testing 
Plan all of the 2015 Edition and 2015 Cures Update Edition certification criteria subject to the 
Real World Testing Condition & Maintenance of Certification requirements at 45 CFR 170.405 
that were certified as of August 31, 2023. 


Within the 2024 RWT plan each Certified Health IT Module is organized the way the criteria are 
listed on ONC’s Certified Health IT Product List (CHPL). In some cases, testing plans have 
been combined for efficiency to account for multiple Certified Health IT Modules where a 
criterion is certified under more than one certified Health IT module. 


RWT plans involve the use of production activity data from actively using the Certified Health IT 
Modules. This production activity data is aggregated across clients and no protected health 
information (as defined by HIPAA) or client-specific identifiable information is used or contained 
in the information provided in our RWT results. 


Updox affirms that this Real World Testing plan is complete with all required elements, including 
measures that address all certification criteria and care settings. All information in this plan is 
up to date and fully addresses Updox’s Real World Testing requirements. 


Kathy Howard, Director of Compliance 


khoward@updox.com 
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Plan Report ID Number: 
Developer Name: Updox LLC 
Product Name(s): Updox LLC 
Version Number(s): 2022.0 
2022.1 
Certified Health IT: December 30,2022 
Product List (CHPL) ID(s): (v2022.0)15.04.04.2484.Updo.20.01.1.21230 
Product List (CHPL) ID(s): (v2022.1) 15.04.04.2484.Updo.21.02.1.221230 
Public URL: https://www.updox.com/company/certifications 


Product List: 


170.315 (e)(1): View, Download, and Transmit to 3rd Party 
170.315 (h)(2): Direct Project, Edge Protocol, and XDR/XDM 


Real World Testing (RWT) was created so Certified Health IT Developers could demonstrate 
conformance with the ONC Cures Act Final Rule. As a Condition of Certification and ongoing 
Maintenance of Certification, developers with one or more Health IT modules certified to any of 
the certification criteria outlined in §170.405 (a) of ONC Cures Act Final Rule must successfully 
test the real-world use of those modules. By using settings and scenarios in a production 
environment vs a testing environment Updox can demonstrate functionality and interoperability 
of their certified health IT. RWT in “real-life” settings also shows transparency to compliance of 
certification criteria made available to the public via the CHPL. 


A Certified Health IT Developer’s demonstration of interoperability-focused functionality is 
critical to advancing transparency on the Health IT Modules’ performance and provides 
information that could help users decide which certified health IT to acquire. As defined 
in§170.102 of the ONC Cures Act Final Rule, “Interoperability is, with respect to health 
information technology, such health information technology that— 


1) Enables the secure exchange of electronic health information with, and use of electronic 
health information from, other health information technology without special effort on the part of 
the user. 


2) Allows for complete access, exchange, and use of all electronically accessible health 
information for authorized use under applicable state or federal law; and 


3) Does not constitute information blocking as defined in § 171.103. 


Justification for Real World Approach: 


For 2024 RWT, Updox will be demonstrating compliance and interoperability within two 
certification criteria The first is Patient Engagement §170.315 (e)(1) view, download and 
transmit to 3 party and the second is Electronic Exchange §170.315 (h) (2) Direct Project, 
Edge Protocol, and XDR/XDM. 
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Measurement/Metric Associated Certification Criteria 


Conformance to this criterion by using the DT Patient Engagement §170.315 (e)(1) view, 
(DirectTrust) interoperability testing between download and transmit to 34 party 
HISPS performed biannually. 


Conformance to this criterion by using Direct Electronic Exchange §170.315 (h) (2) Direct 
Secure Messaging for sending “Transitions of Project, Edge Protocol, and XDR/XDM. 
Care” documents via secure messaging to a 34 


party. 


Updox primarily markets to EHR vendors (not end users) in order to integrate our products into 
their EHR. We market our secure messaging products to our partners, which is a valuable tool 
that aligns with ONC’s push for interoperability. Secure messaging allows providers to 
communicate securely with patients and other providers. This promotes interoperability, gives 
consumers/patients more control of their own health and follows Privacy and Security rules for 
keeping patient health information within a secure environment. 


Care Setting 
DirectTrust *Promotes interoperability 
*Is a trusted and reliable source for exchange and 
reporting of Direct Secure Messaging 
*Continues to improve and work with regulating 
authorities to promote interoperability and 


reducing SDOH 


*Demonstrates interoperability between HISPS 
EHR Vendors and top EHR vendors 

*Primary target market for Updox 

*Proves interoperability between providers 

exchanging PHI/PII in secure environments 


RWT Multiple Criteria 


Updox has developed a system to ensure providers can share PHI (personal health information) 
of their patients in a secure environment in which messages and documents can be shared by 
using Direct Secure Messaging via our API, Ul, Edge protocol or XDR/XDM. Through our 
Patient Portal, which is integrated into our Partners EHR systems, patients have the ability to 
view, download, and transmit. ePHI/PII is always encrypted and hashed to prevent unauthorized 
access or tampering and our encryption standard is AES 256. The hashing standard is SHA-2. 
TLS 1.2 is used when transmitting information over the internet. Updox is currently Web Content 
Accessibility supported by the Health IT Module: Web Content Accessibility Guideline (WCAG) 
2.0, Level A Conformance as specified in § 170.204(a)(1). 


Justification for RWT Approach: 
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Patient Engagement §170.315 (e)(1) view, *(1)(B)(2) Download ambulatory summary or inpatient 
download and transmit to 3'4 party summary using CCD Template 
*(1)(C)(1) Transmit to third party 


Electronic Exchange §170.315 (h) (2) Direct *Applicability Statement for Secure Health Transport, 


Project, Edge Protocol, and XDR/XDM. Version 1.2 (the “Direct Project” specification). 
*The ONC XDR and XDM for Direct Messaging 
Specification, Version 1, including support for both 
limited and full XDS metadata profiles. 
*And both protocols in the ONC Implementation 
Guide for Direct Edge Protocols, Version 1.1 


Updox will apply its testing to other companies that are promoting interoperability since that is 
the primary market for our products at this time. Other HISPs and EHR vendors will apply to this 
care setting. Updox will include all criteria to demonstrate conformance involving §170.315 
(e)(1) view, download and transmit to 3" party and Electronic Exchange §170.315 (h) (2) Direct 
Project, Edge Protocol, and XDR/XDM. 


Using this approach helps promote interoperability by testing with other vital HISPs and several 
major EHR vendors to demonstrate compliance with all rules, regulations and laws pertaining to 
these two testing criteria. We will demonstrate conformance by providing logs of “real-world” 
processes in a production environment and will rely on two accrediting bodies Direct Trust and 
EHNAC to validate results. Direct Trust’s HISP to HISP testing with the Accredited Trust Bundle 
is also used to assess potential interoperability issues in the field and to evaluate new HISP 
participants entering the Accredited Trust Bundle. Members of DT share details about their 
findings during the bi-annual interop testing within a Security and Trust Compliance Workgroup. 


The formal discussion of these issues within the workgroup leads to progress and consensus 
interpretation of standards and policies, identification of the causes of variability and the 
shortcomings of the existing specifications brought to light through the deployment of Direct 
exchange at scale, and eventual determination of the best practices for improved 
interoperability. 


The Updox system includes these functionalities of interest: (A) Send Direct Secure message 
summaries (B) receive Direct Secure message summaries (C) Edge Protocol used for 
processing or if EHI was shared through the patient portal using downloads,encrypted and 
unencrypted transmissions. 


Standard (and version) USCDI v2 
C-CDA Companion Guide (Release 2.1) 
ASTM Updates E1247-18 
WCAG v2.0 Level A 


2015 Edition Cures Update 


Patient Engagement §170.315 (e)(1) view, 
and associated product download and transmit to 3rd part 
Health IT Module CHPL ID (v2022.0)15.04.04.2484.Updo.16.00.0.170720 
(v2022.1)15.04.04.2484.Updo.61.01.0.170720 


Date of ONC ACB notification October 2022 
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Date of customer notification (SVAP only) Not Applicable 


Conformance measure Conformance to this criterion by using the DT 
(DirectTrust) interoperability testing between 
HISPS performed annually. 


USCDI updated certification criteria (and The plan documents the support of all USCDI v2 
USCDI version) data elements. The plan documents the support 
of all USCDI v2 data elements. 


Expected Outcomes: 


1. Real World Testing will demonstrate that Updox is conformant to the following certification 
criteria: §170.315 (e)(1) view, download and transmit to 3" party. 


Regulation Text § 170.315 (e)(1) View, download, and transmit to 3rd party—Patients (and their 
authorized representatives) must be able to use internet-based technology to view, download, and 
transmit their health information to a 3rd party in the manner specified below. Such access must be 
consistent and in accordance with the standard adopted in § 170.204(a)(1) and may alternatively be 
demonstrated in accordance with the standard specified in § 170.204(a)(2). 


and Electronic Exchange §170.315 (h) (2) Direct Project, Edge Protocol, and XDR/XDM. 


Regulation Text §170.315 (h)(2) Direct Project, Edge Protocol, and XDR/XDM— (i) Able to send and 
receive health information in accordance with: (A) The standard specified in §170.202(a)(2), including 
formatted only as a “wrapped” message; (B) The standard specified in §170.202(b), including support for 
both limited and full XDS metadata profiles; and (C) Both edge protocol methods specified by the 
standard in §170.202(d). (ii) Delivery Notification in Direct. Able to send and receive health information in 
accordance with the standard specified in §170.202(e)(1). 


2. Real World Testing will demonstrate the ability of direct secure messaging between HISPs 
and between providers in our provider directory that are vetted and have a certified address or 
domain bound certificate issued to them. 


3. Real World Testing will demonstrate that Updox supports the Electronic Exchange §170.315 
(h) (2) by using Edge protocol technology. 


Key Milestones: 


Release of documentation for the Real-World February 1, 2024 
Testing to be provided to EHR vendors, especially 

ones that use Updox as relied upon software for 

their certifications and participating HISPs. 

Specific instruction on what to look for, how to 


record issues encountered, and other relative 
agreements/notifications. 


documented in the RWT plan. 
data as they arise 
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Follow-up with HISPs and EHR vendors on a March 202 (Qtrly) 
regular basis to understand issues arising with the 
data collected. 


HISP to HISP testing with the Accredited Trust April 2024 
Bundle. 

Follow-up with HISPs and EHR vendors on a June 2024 (Qirly) 
regular basis to understand issues arising with the 

data collected. 

Follow-up with HISPs and EHR vendors on a Sept. 2024 (Qtrly) 
regular basis to understand issues arising with the 


data collected. 

Create a New Testing Plan with new certified November 1,2024 
criteria included. Submit to Drummond Group: 

Follow-up with HISPs and EHR vendors on a December 2024 (Qtrly) 
regular basis to understand issues arising with the 

data collected. 


collected. 
documentation. 


Testing Procedure/Process between Accredited 
HISPs: 


HISP to HISP testing with the Accredited Trust Bundle is used to assess potential 
interoperability issues and as a Condition of Certification with Direct Trust (DT). This testing is 
done annually in the month of April. Results must be sent to DT and for the RWT results Updox 
will report a minimum of 4. HISP to HISP Direct Secure Messaging includes both criteria, 
§170.314(e)(1), View/Download/Transmit and Electronic Exchange §170.315 (h) (2) Direct 
Project, Edge Protocol, and XDR/XDM. This testing is performed in “real-world” settings and 
promotes interoperability. 


To initiate interoperability testing, Updox will send a wrapped, DT compliant message from our 
Updox Accredited Trust Bundle address to each HISP’s interop testing address which will be in 
a production environment using a “test” account so that no ePHI is involved. Within the 
message and out of band, we will indicate that we are performing RWT and request a received 
& readable confirmation. When a message is received from another testing participant, we will 
reply to the message indicating whether the message was received and readable and (if 
receiving into an EMR system and a C-CDA was included in the message) whether the attached 
C-CDA could be incorporated into our system). 


RESULTS OF SENDING FROM MY ADDRESS TO THE COUNTERPARTY ADDRESS: 
*Message was sent to this counterparty (left my system without immediate fail) AND 
Processed MDN was Received and Usable by my system 

ONLY IF DISPATCHED REQUESTED (Updox always requests Dispatched MDN): 


Dispatched MDN was received and usable by my system. 


DocuSign Envelope ID: A265639F-7715-4C09-97F 1-5E9391 1B5CBE 


If our system successfully receives the dispatched MDN from the Counterparty, then we will 
answer “Yes.” If our system does not receive the dispatched MDN from the Counter Party 
during our system’s allowed timeout interval, then we will answer “No.” In our report to DT we 
will report successful or not successful transmission and the same in our Real-World Testing 
report which will be submitted in January of 2023. 


*Beyond the MDN: Counterparty confirmed the message | sent to them was received and its 
payload could be incorporated (if the receiving system is an EHR endpoint) OR was readable (if 
the receiving system is a HISP endpoint). Counterparty may alternatively confirm this in their 
own report. 


In August 2017 during a meeting of the Security and Trust Compliance workgroup with 
DirectTrust the following guideline was established: 


If the receiving party does not reply and confirm the message, the sending party must make two 
attempts and allow three business days per attempt to confirm the received and readable 
confirmations. 


If there is no reply after following the guideline, we will include the dates of our attempts in the 
Comments section to DT so that our test results will reflect a positive test. We will also include 
all results successful or otherwise in our Real-World Testing Report. 


The following list are the likely reasons for a failed test: 

1. Processed MDN not received 

. Out of band received and readable confirmation not yet available 
. Certificate expired 

. Certificate revoked 

. Unsolicited Dispatched MDN received 

. Processed MDN not received when C-CDA payload attached 

. Dispatched MDN not received when requested 


. Message Digest Issue in sent message preventing trust validation 


oO oOo N O a Aa WwW N 


. Could not determine revocation status 
10. Message contained additional stray content not expected. 


The Payload Archive is used to store the files that are sent and/or received. No PHI should be in 
the sample files. Sample files should be either C-CDA or XDM Zip files and available in the DT 
Payload Archive. The C-CDA sample filename, XDM Zip sample filename, or another sample 
filename from the DT payload archive should be entered in the report to DT. 


A factor complicating XDM transmission is the choice of MIME type to identify the attachment. 
To facilitate interoperability, DT recommends that all senders of XDM Zip attachments label the 
attachment with the MIME type application/zip. Recipients should examine attachments labeled 
as either application/zip or application/octet-stream for potential XDM content, however, as the 
latter MIME type is also encountered in the field. 
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The payloads systems may receive are the C-CDA and human readable versions thereof, as 
part of §170.314(e)(1), View/Download/Transmit. Certification standards are more flexible for 
this measure, and may include, for example, PDF, HTML, and XML+XSL as the human- 
readable file types. This use case introduces situations in which EHR summaries of care may 
be sent to provider recipients in many different potential file formats that the receiving systems 
are not necessarily prepared to accept. 


Examples of additional content/payload-related practices which may hinder interoperability 
include: 


-Accepting messages that contain a text part or a payload attachment, but not both 


- Accepting only messages that contain a MU2 payload (This condition would not cause a 
secure messaging failure in Updox, however, an EHR system may have a limitation.) 


- Expecting the text part before the C-CDA or not accepting a message if sender adds message 
parts out of the expected order. (This condition would not cause a secure messaging failure in 
Updox, however, an EHR system may have a limitation.) 


-Sending a payload referencing a proprietary, privately hosted, or unconventionally named style 
sheet which may not be universally accessible due to recipient’s firewall settings or may 
introduce security risks to the recipient 


-Sending broken or invalid HTML as part of the XDM container, the message body itself, or one 
of the attachments, potentially making the content non-viewable by some recipients 


-Self-imposed C-CDA or other structural data or metadata validation causing receivers to accept 
too narrowly--such that C-CDAs or XDM Zip files that would have been declared valid by 
certification testing are not incorporated or entire messages are dropped. 


Testing Process for testing with Partners/EHR vendors- 


Testing will be conducted between 2-3 of our EHR Partners and will be conducted once every 
quarter. We will first need to ensure that each Partner Portal has a “test” account/patient set up 
in a production environment for testing purposes only. These accounts will be used to show the 
view, download, transmit functionality by patient and patient representative. 


The Updox system includes these functionalities of interest: 
(A) Send Direct Secure message summaries 
(B) receive Direct Secure message summaries 


(C) Edge Protocol used for processing or if EHI was shared through the patient portal 
using downloads and encrypted or unencrypted transmissions. 


Patient Portal 1: 


To test with Partner 1 as an EHR we will use the company ABC Example, as they use Updox for 
transmission of their “transitions of Care.” 
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Scenario 1: A patient is experiencing severe eye pain and is referred to an Ophthalmologist by 
their Primary Care Provider (PCP). The PCP needs to generate a summary document to 
provide to the Ophthalmologist. 


This use case exhibits the “Transition of Care” criterion in action: § 170.314 (b)(2) Transitions of 
care — create and transmit transition of care/referral summaries. 


In this scenario, treatment has been provided by a PCP: « Given that this treatment is in an 
ambulatory setting, a Discharge Summary would not be appropriate. * Since the PCP HAS NOT 
been providing care at the request of another provider, a Consultation Note would not be 
appropriate. « Given the clinical scenario to be described, a Continuity of Care Document (CCD) 
is the most appropriate C-CDA Document Template to use. 


Continuity of Care Document (CCD)- The CCD is a core data set of the most relevant 
administrative, demographic, and clinical information facts about a patient's healthcare, covering 
one or more healthcare encounters. 


In this particular scenario this information contained in the C-CDA will always be clinically 
relevant. Pt. Demographics, Allergies, Medications, Problem, Results 


This information contained in the C-CDA will sometimes be clinically relevant. Encounters, Plan 
of Care, and Vital Signs 


These are the additional criteria that are required by USCDI (other than already listed items). 
Care team members, Laboratory tests/results, Procedures, Smoking Status, Provider Name & 
Office Contact, Reason for Referral, Encounter Diagnosis, Cognitive Status, Functional Status, 
and Immunizations that can be added if needed. 


View- The patient via the Pt. Portal, must be able to use technology to download at a minimum, 
the following data as applicable: 


e The data classes in accordance with § 170.213 United States Core Data for 
Interoperability Standard (USCDI) as specified in section (e)(1)(i)(A)(7) and 
i. Assessment and Plan of Treatment as specified in section (e)(1)(i)(A) (3)(i); 
ii. Goals as specified in section (e)(1)(i)(A) (3) (ii); 
iii. Health Concerns as specified in section (e)(1)(i)(A) (3) (iii); 
e Ambulatory setting only: the provider's name and office contact information as specified 
in section (e)(1)(i)(A)(4); 
e Laboratory test report(s) as specified in section (e)(1)(i)(A)(6), when available; and 
e Diagnostic Imaging report(s) as specified in section (e)(1)(i)(A)(7), when available. 


Download- The patient via the Pt. Portal must be able to use technology to download an 
ambulatory summary in the following formats: Human readable format; and the format specified 
in accordance with the standard specified in § 170.205(a)(4) following the CCD document 
template. The user uses the internet-based technology health IT function(s) to download an 
ambulatory summary document in section (e)(1)(i)(B) that is formatted as a CCD document 
according to the standard specified in § 170.205(a)(4) HL7 Implementation Guide for CDA® Release 
2: Consolidated CDA Templates for Clinical Notes with Errata, DSTU Release 2.1 and § 
170.205(a)(5) HL7 CDA® R2 IG: C-CDA Templates for Clinical Notes R1 Companion Guide, 
Release 2. 
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Transmit to a third party- The patient via the Pt. Portal will transmit the ambulatory summary 
of care by these two methods: Email transmission to any email address(unencrypted) and an 
encrypted method of electronic transmission. 


Unencrypted Email Method 


1. For each data set viewed in section (e)(1)(i)(A), the user, with the role of patient, uses the 
Health IT Module’s internet-based technology to transmit, via email, an ambulatory summary 
as created in section (e)(1)(i)(B)(2) as a CCD document according to the standards specified 
in § 170.205(a)(4) HL7 Implementation Guide for CDA® Release 2: Consolidated CDA 
Templates for Clinical Notes with Errata, DSTU Release 2.1 and § 170.205(a)(5) HL7 CDA® 
R2 IG: C-CDA Templates for Clinical Notes R1 Companion Guide, Release 2 to a valid, 
third-party email address identified by the user. 

2. The user accesses the third-party email account and verifies that the transmission was 
received, and the correct ambulatory summary is attached. 


Encrypted Method 


1.For the data set viewed in (e)(1)(i)(A), a user, with the role of patient, uses the Health IT 
Module’s internet-based technology to transmit an ambulatory summary or inpatient summary as 
created in section (e)(1)(i)(B)(2) as a CCD document according to the standards specified in § 
170.205(a)(4) HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for 
Clinical Notes with Errata, DSTU Release 2.1 and § 170.205(a)(5) HL7 CDA® R2 IG: C-CDA 
Templates for Clinical Notes R1 Companion Guide, Release 2 to any third party using the developer- 
identified encrypted method of transmission. 


2. The user accesses the account to which the encrypted message has been sent and 
verifies that the transmission was received with the correct ambulatory and/or inpatient summary. 


Updox would transmit the CCD (Summary document) to the Ophthalmologist’s EHR system 
which would complete the requirements for create and transmit transition of care/referral 
summaries. 


Scenario 2: The Ophthalmologist, after consulting with the patient, schedules surgery to be 
performed and provides an ambulatory summary to the patient including the care plan to be 
followed leading up to the surgery. 


This use case exhibits the “View/Download/Transmit” criterion in action: § 170.314 (e)(1) View, 
download, and transmit to 3rd party. 


In this scenario, treatment has been provided by a PCP: « Given that this treatment is in an 
ambulatory setting, a Discharge Summary would not be appropriate. * The Continuity of Care 
Document (CCD) is intended to summarize a full episode of care, and as such may be too 
cumbersome for this scenario. * Since the Ophthalmologist is providing care at the request of 
the PCP, a Consultation Note is the best fit for the clinical workflow. 


The patient via the Pt. Portal will have the ability to view, download, and transmit the 
Consultation Note and the Care Plan to another provider or keep for their own records. 


When the user utilizes the view, download, or transmit to a third-party capability as specified in 
sections (e)(1)(i)(A) through (e)(1)(i)(C), the Health IT Module records a new activity log entry for the 
following actions related to electronic health information: 


e View of patient information. 


1a 
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e Download patient information; and 
e Transmit patient information. 


For each action, the activity log entry includes: 


Type of action. 

Date and time of event in accordance with the standard specified in § 170.210(g) 
RFC 5905 

User identification; and 

To whom the transmission was sent (if applicable). 


§170.315(e)(1) — View, Download, and Transmit to 3rd Party 


Description of Measurement/Metric 


Though Updox is not a patient centric business we do have metrics to show the VDT of patient 
summaries by views, downloads and transmits. The measures identified will encompass the 
number of views, downloads, and transmits of patient chart summaries. 


e View Chart summary 
o Numerator: # of views of the chart summary 
e Download of chart summary 
o Numerator: # of downloads of chart summary 
e Transmission of chart summary 
o Numerator: # of transmissions of chart summary 


This is a list of Partners that Updox relies on to create a Consolidated Clinical Document 
Architecture (C-CDA) document formatted in accordance with the Continuity of Care Document 
(CCD) document template. These systems create the C-CDA that is then viewable within the 
Patient Portal that Updox provides. These systems can then give access to their patients which will 
then have the ability to view, download, and transmit the C-CDA. 


ACOM 

American Medical Software 
Ankhos Oncology 

ArcSYS 

Chartpath 

Complete Healthcare Solutions 
Creoks Health 

Dentrix 

Dr. Chrono 

DRS Enterprise 

ECL Group 
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eMDs 

First Insight 
Greenway 

Inforia 

MicroMD 

Qualifacts 
SpringMedical Center 
Theramanger 
TotalMD 

Wayspring 


Associated Certification Criteria 


170.315 (e)(1) View, Download, and Transmit to 3rd §170.315(e)(i)(A) 
Party §170.315(e)(i)(B) 
§170.315(e)(i)(C) 


Justification for Selected Measurement/Metric 


The measurements selected demonstrate that chart summaries can successfully be viewed and 
downloaded by patients and exhibits the patient was successful in the process of transmitting to 
external parties. 


Test Methodology 


We will utilize a Patient portal 1 and 2 to access data related to the ability of clients to view, 
download, and transmit their data to external parties. Patient portal 1 and 2 utilizes log files to 
capture the relevant data points. If there’s no record of client usage, we will utilize internal 


testing systems to demonstrate functionality and compliance. 


Conclusion 


Updox will include all documentation and results in our Real-World Testing Results Report due in 
March of 2025. The results submitted will be based on and directly related to this plan and will 
address each required element in this plan. The results report will reflect what we state in this plan. If 


Updox Developers discover during Real World Testing that methods/methodologies, 
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measurements/metrics, and other approaches selected do not produce the anticipated expected 
outcomes or issues arise during the collection of data that require a developer to adjust their 
strategies then developers will adjust their methods/methodologies and report this adjustment in our 
results report. Updox will then submit the data derived from its original approaches with a statement 
indicating that in retrospect a more appropriate approach was established. The results report will 
clearly indicate the adjustments made, when they were made, and how the results reflect the new 


approaches, if they are necessary. 
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